Flossie & Locke // Privacy Policy

privacy policy

last updated: 1 september 2026

Flossie & Locke respects your privacy. This policy explains what personal information we collect, why we use it, who we may share it with and the choices you have about your information when you visit this website, make an enquiry or work with us.

01. who is responsible for your data

Flossie & Locke is responsible for the personal information covered by this policy and acts as the data controller for the purposes of UK data protection law.

If you have a question about your personal information, email hello@flossieandlocke.com .

02. information we may collect

Depending on how you deal with Flossie & Locke, we may collect:

  • Contact information: your name, business name, email address, telephone number and anything else you choose to include when contacting us.
  • Project information: information about your business, brand, marketing, clients, website, digital presence and existing activity that you provide while enquiring about or receiving a service.
  • Payment and transaction information: information relating to services you purchase. Card payments are processed by the relevant payment provider and Flossie & Locke does not store your full card details.
  • Website information: information such as your IP address, device or browser information and how you use this website, where this is collected through Squarespace or permitted cookies and analytics.
  • Business contact information: professional contact details and publicly available business information where there is a legitimate reason for Flossie & Locke to contact or research a business.

03. how we use your information

We may use personal information to:

  • respond to enquiries and discuss potential work;
  • provide the Digital Diagnostic, The Edit, Brand Partnership or other agreed work;
  • communicate with clients about projects, meetings, invoices and agreed work;
  • process payments and maintain appropriate financial records;
  • operate, protect and understand the performance of this website;
  • research and contact businesses where we have a legitimate business reason to do so; and
  • meet legal, accounting and regulatory requirements.

04. our lawful reasons for using your information

Depending on the circumstances, we rely on one or more of the following lawful bases:

  • Contract: where we need the information to provide a service you have asked us to provide or to take steps before entering into a contract.
  • Legitimate interests: where it is reasonably necessary to operate and develop the business, communicate with clients and potential clients, protect the website, maintain records or undertake appropriate business development, provided those interests are not overridden by your rights.
  • Legal obligation: where we need to keep or use information to comply with UK law, including tax and accounting requirements.
  • Consent: where we have specifically asked for your consent, for example for certain non-essential cookies or other activities where consent is required.

05. who we may share information with

We do not sell your personal information.

We may share information with trusted providers where necessary to run the business or provide agreed services. This may include website hosting, email and cloud services, payment processing, analytics, professional advisers and specialist contractors working on an agreed client project. We only share information that is reasonably required for the relevant purpose.

06. information processed outside the uk

Some of the service providers used to operate Flossie & Locke may process information outside the United Kingdom. Where this happens, we use providers that put appropriate safeguards in place for international transfers where required by data protection law.

07. how long we keep information

We keep personal information only for as long as there is a genuine business, contractual or legal reason to keep it. Enquiry information that does not lead to work is periodically deleted. Client and project records are retained for an appropriate period after work ends, and some financial and contractual records may need to be kept for longer to meet accounting, tax or legal requirements. Information is securely deleted or anonymised when it is no longer required.

08. keeping information secure

We take reasonable technical and organisational steps to protect personal information against loss, misuse, unauthorised access, alteration or disclosure. Access to client information is limited to the people and service providers who genuinely need it for the work being carried out.

09. your rights

Depending on the circumstances, UK data protection law gives you rights over your personal information. These may include the right to:

  • ask for a copy of the information we hold about you;
  • ask us to correct inaccurate information;
  • ask us to erase information in certain circumstances;
  • ask us to restrict how information is used;
  • object to certain uses of your information;
  • request transfer of certain information where applicable; and
  • withdraw consent where we rely on consent.

To exercise a data protection right, contact hello@flossieandlocke.com .

10. complaints

If you have concerns about how your personal information has been handled, please contact us first so we have the opportunity to look into it. You also have the right to complain to the Information Commissioner’s Office, the UK regulator for data protection.

11. changes to this policy

We may update this policy when the way we use personal information changes or when legal requirements change. The latest version will always appear on this page with the date it was last updated.